identity-authentication-vulnerabilityinternet-facing-service-vulnerabilitywidely-deployed-product-advisory

XenForo 2.3.7 Fixes Passkey Authentication Bypass and Path Disclosure Flaws

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Apr 1, 2026

XenForo released fixes in version 2.3.7 for two newly disclosed vulnerabilities affecting earlier versions of the forum platform. The more severe issue, tracked as CVE-2025-71279, is a CWE-287 authentication weakness involving passkeys added to user accounts that could allow an unauthenticated remote attacker to compromise passkey-based authentication. The flaw carries a CVSS 3.1 rating of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high impact across confidentiality, integrity, and availability.

A second flaw, CVE-2025-71282, is a CWE-209 information disclosure bug that can expose filesystem paths through exception messages triggered by open_basedir restrictions. That issue affects XenForo versions before 2.3.7 and could help attackers map a server's directory structure, with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Advisory references and the XenForo release notice indicate that upgrading to 2.3.7 addresses both vulnerabilities.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Apr 1, 2026

Apr 1, 20267mo ago
CVE-2025-71282 published for XenForo path disclosure issue
A CVE entry was published for a XenForo information disclosure flaw in versions before 2.3.7 that could reveal filesystem paths through open_basedir exception messages. The issue was classified as CWE-209 and described as a network-accessible confidentiality-impacting vulnerability.
Apr 1, 20267mo ago
CVE-2025-71279 recorded for XenForo passkey security bypass
A CVE entry was recorded for a XenForo vulnerability affecting passkeys on user accounts in versions before 2.3.7. The issue was classified as CWE-287 and described as a remotely exploitable authentication-related flaw with high impact.
Apr 1, 20267mo ago
XenForo 2.3.7 released with security fixes
XenForo released version 2.3.7, and the release notice indicated it included fixes for security issues later tracked as CVE-2025-71279 and CVE-2025-71282 affecting versions before 2.3.7.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

XenForo open_basedir exception path disclosure (CVE-2025-71282)Passkey Authentication Security Bypass in XenForo before 2.3.7 (CVE-2025-71279)

Affected products

1 linked

Xenforo

Organizations

1 linked

Xenforo

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Apr 1, 2026

CVE-2025-71279 - XenForo Passkey Security BypassOpen source ↗

Cvefeed High SeverityAdvisories · Apr 1, 2026

CVE-2025-71282 - XenForo Path Disclosure via open_basedir ExceptionsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

XenForo 2.3.7 Fixes Passkey Authentication Bypass and Path Disclosure Flaws

How this story unfolded

CVE-2025-71282 published for XenForo path disclosure issue

CVE-2025-71279 recorded for XenForo passkey security bypass

XenForo 2.3.7 released with security fixes

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Multiple XenForo Flaws Expose Forums to RCE, Scope Abuse, and Template Bypass

Patched File Browser flaws enable auth bypass and arbitrary file deletion

Xen Advisories Disclose Linux Guest Kernel Flaws Enabling Privilege Escalation

XenForo 2.3.7 Fixes Passkey Authentication Bypass and Path Disclosure Flaws

How this story unfolded

CVE-2025-71282 published for XenForo path disclosure issue

CVE-2025-71279 recorded for XenForo passkey security bypass

XenForo 2.3.7 released with security fixes

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Multiple XenForo Flaws Expose Forums to RCE, Scope Abuse, and Template Bypass

Patched File Browser flaws enable auth bypass and arbitrary file deletion

Xen Advisories Disclose Linux Guest Kernel Flaws Enabling Privilege Escalation